dnoyeb

I have several attempts by my linux box to connect to a remote port 139
over the weekend. only new software running was azureus. Any idea what
it might be doing?

Several netbios packets filtered

192.168.0.2:25330 to 84.188.112.14:139
192.168.0.2:25330 to 84.188.112.14:139
192.168.0.2:25330 to 80.199.53.26:139


thanks,

CL

aragorn

The message suggests a NetBIOS connection., which is a Windows-specific type
of networking based upon IBM's archaic NetBEUI protocol. It's supposed to
be non-routable and is considered highly unsafe when routed over TCP/IP.

Port 139 is the port typically used by the Windows Server Message Block
(SMB) and Common Internet FileSystem (CIFS), both handled in UNIX via
Samba, and both pertaining to file- and printersharing.

Considering that you've been running Azureus - which I believe to be a
peer-to-peer filesharing application - your machine was most likely
connected to a Windows machine on the internet for downloading or
uploading. ;-)

Another possibility would be that you have your GNU/Linux machine act as a
gateway/router/NAT for a Windows client computer behind on your LAN, which
is attempting a filesharing connection to another Windows machine which is
directly on the internet, but then (1) you would know about that since you
would have set it up that way yourself, (2) it'd still only be filesharing
and (3) you've already mentioned that you were running Azureus, so I think
the latter possibility is unlikely. ;-)

--
*Aragorn*
(registered GNU/Linux user #223157)

dnoyeb

192.168.0.2:25330 to 84.188.112.14:139
192.168.0.2:25330 to 84.188.112.14:139 192.168.0.2:25330 to 80.199.53.26:139


I am running samba, but I have never seen an outbound port 139 connect
attempt. That would require a samba client which I am not using on Linux.
Azeureus listens on port 25330. Its odd to see something going OUT from
that same port. And being targeted at port 139 on some computer I know
nothing about is even odder.

Azeureus is a bittorrent client. AFAIK it does not use netbios.

Does bittorrent pick random ports for its connections?

aragorn

Apparently, your Azureus is connecting to a Samba serverport on the remote machines.


No, but it /may/ be using the SMB protocol, since that is supported on just
about every operating system. UNIX supports SMB through Samba, and Windows
supports it natively, so that would seem like the best choice to build a bittorrent application on.


This I cannot answer you, but either way, you know that Azureus uses port
25330 on your machine, and 192.168.0.2 is most likely your IP address -
you're obviously behind a router with NAT - so if you know that Azureus is
a bittorrent client, then what exactly about the connection is it that you find suspicious?
<confused>

--
*Aragorn*
(registered GNU/Linux user #223157)

david w. hodgins

I suspect one of the other sharers has set up their system to use port 139,
in order to try and hide the bittorrent connections, from their isp, in order
to avoid traffic shaping.

Shouldn't be a problem for your linux box.

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

dnoyeb

Ahh, that makes sense. Kinda strange, but it explains everything. I bet
they don't get many shares, LOL.


CL